CVE-2026-56811: phoenix from 1.2.0 (inclusive), before 1.5.15 (exclusive), from 1.6.0 (inclusive), before 1.6.17 (exclusive), from…

Affected technology

phoenix · from 1.2.0 (inclusive), before 1.5.15 (exclusive)
phoenixframework

phoenix · from 1.6.0 (inclusive), before 1.6.17 (exclusive)
phoenixframework

phoenix · from 1.7.0 (inclusive), before 1.7.24 (exclusive)
phoenixframework

phoenix · from 1.8.0 (inclusive), before 1.8.9 (exclusive)
phoenixframework

phoenix · 0.11.0 to before 1.5.15, 1.6.0-rc.0 to before 1.6.17, 1.7.0-rc.0 to before 1.7.24, 1.8.0-rc.0 to before 1.8.9
phoenixframework

phoenix · 14a297e88023cb280a577962a49a0bbdeef9f4eb to before *; status changes: c498ba8cf49f6accbbd0c643a5340b58db891218 — unaffected, d19ca0a8d9f82c130b7ed339b9f033433e2dea5e — unaffected, a612100cd8a4279091abc1a2ef8fb98a6d01c0a1 — unaffected, 16e295d2fccab185d1292322e2bee5d46c725c8a — unaffected
phoenixframework

Component: 'Elixir.Phoenix.Socket'
Function: 'Elixir.Phoenix.Socket':handle_in/4
File: lib/phoenix/socket.ex

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An unauthenticated attacker can cause a denial of service against any endpoint that mounts a Phoenix socket with a reachable channel transport (WebSocket or LongPoll). Source advisory’s CVSS 4.0 assessment (base score 8.7/10) rates confidentiality and integrity impact as none; availability impact as high.